ework-aio 0.2.7 → 0.2.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ework-aio",
-  "version": "0.2.7",
+  "version": "0.2.9",
   "description": "All-in-one installer for ework (issue tracker) + ework-daemon (AI bridge) + opencode-ework (plugin). One command: npm i -g ework-aio && ework-aio install.",
   "type": "module",
   "license": "MIT",

package/scripts/e2e-browser.sh

@@ -0,0 +1,322 @@
+#!/usr/bin/env bash
+# End-to-end browser test: install → fake LLM → opencode config → Playwright.
+#
+# This is the "full product path" test. Compared to e2e-install.sh (which
+# covers install/subcommand/lifecycle), this script:
+#   - Starts a fake OpenAI-compatible LLM server (scripts/fake-llm-server.ts)
+#   - Configures opencode.json to use it (no external API needed)
+#   - Creates an issue (which triggers daemon → opencode → fake LLM)
+#   - Drives a headless browser through ework-web UI
+#   - Verifies the resulting session is browsable and shows content
+#
+# Requires Docker image with Chromium pre-installed. The Dockerfile.regression
+# image handles this; pass via IMAGE env or rely on the default.
+#
+# Usage: ./scripts/e2e-browser.sh [container-runtime] [npm-tag]
+
+set -euo pipefail
+
+RUNTIME="${1:-docker}"
+NPM_TAG="${2:-latest}"
+IMAGE="${IMAGE:-ework-aio:e2e}"
+
+c_grn=$'\033[32m'; c_red=$'\033[31m'; c_ylw=$'\033[33m'; c_rst=$'\033[0m'
+pass() { printf '%sPASS%s %s\n' "$c_grn" "$c_rst" "$*"; }
+fail() { printf '%sFAIL%s %s\n' "$c_red" "$c_rst" "$*"; exit 1; }
+info() { printf '%s…%s %s\n' "$c_ylw" "$c_rst" "$*" >&2; }
+
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+
+if ! "$RUNTIME" image inspect "$IMAGE" >/dev/null 2>&1; then
+  info "Building $IMAGE (with Chromium deps — first build is slow)"
+  "$RUNTIME" build --network=host -f "$REPO_ROOT/Dockerfile.regression" \
+    -t "$IMAGE" "$REPO_ROOT"
+fi
+
+info "Using image: $IMAGE"
+
+# Hardcoded ports — see e2e-install.sh for why we don't inherit from host.
+WORK_PORT="14002"
+DAEMON_PORT="14101"
+FAKE_LLM_PORT="8400"
+
+OPENCODE_HOST_BIN="${OPENCODE_HOST_BIN:-/home/dog/.local/bin/opencode}"
+
+"$RUNTIME" run --rm -i --network host \
+  -v "$OPENCODE_HOST_BIN:/usr/local/bin/opencode:ro" \
+  -v "$REPO_ROOT/scripts:/host-scripts:ro" \
+  -v "$REPO_ROOT/test:/host-test:ro" \
+  -e WORK_PORT="$WORK_PORT" \
+  -e DAEMON_PORT="$DAEMON_PORT" \
+  -e FAKE_LLM_PORT="$FAKE_LLM_PORT" \
+  -e NPM_TAG="$NPM_TAG" \
+  -e HTTP_PROXY="${HTTP_PROXY:-}" \
+  -e HTTPS_PROXY="${HTTPS_PROXY:-}" \
+  -e http_proxy="${HTTP_PROXY:-}" \
+  -e https_proxy="${HTTPS_PROXY:-}" \
+  -e NO_PROXY="127.0.0.1,localhost" \
+  "$IMAGE" bash -euo pipefail <<'EOSCRIPT'
+set -euo pipefail
+
+
+c_grn=$'\033[32m'; c_red=$'\033[31m'; c_ylw=$'\033[33m'; c_rst=$'\033[0m'
+pass() { printf '%sPASS%s %s\n' "$c_grn" "$c_rst" "$*"; }
+fail() { printf '%sFAIL%s %s\n' "$c_red" "$c_rst" "$*"; exit 1; }
+info() { printf '%s…%s %s\n' "$c_ylw" "$c_rst" "$*" >&2; }
+
+WORK_PORT="${WORK_PORT:-14002}"
+DAEMON_PORT="${DAEMON_PORT:-14101}"
+FAKE_LLM_PORT="${FAKE_LLM_PORT:-8400}"
+NPM_TAG="${NPM_TAG:-latest}"
+DATA_DIR=/tmp/aio-browser
+
+info "clean state"
+rm -rf "$DATA_DIR"
+mkdir -p "$DATA_DIR"
+
+info "opencode binary on PATH"
+opencode --version | head -1
+
+info "install ework-aio@${NPM_TAG} + deps"
+for pkg in ework-web ework-daemon opencode-ework; do
+  npm install -g "$pkg@latest" 2>&1 | tail -2
+done
+npm install -g "ework-aio@${NPM_TAG}" 2>&1 | tail -2
+
+info "install Playwright npm package (browser itself is pre-baked into image)"
+# Install into a local node_modules so module resolution works regardless of
+# whether we drive the test via `node` or `bun`. Global installs don't get
+# picked up by Node's import resolver.
+mkdir -p /tmp/test-runner
+cd /tmp/test-runner
+npm init -y >/dev/null
+npm install playwright 2>&1 | tail -2
+
+info "start fake LLM server in background"
+PORT="$FAKE_LLM_PORT" bun run /host-scripts/fake-llm-server.ts 2>/tmp/fake-llm.log &
+FAKE_LLM_PID=$!
+# Wait for server to come up.
+for i in $(seq 1 30); do
+  if curl -sf "http://127.0.0.1:$FAKE_LLM_PORT/v1/models" >/dev/null; then
+    pass "fake LLM up (pid $FAKE_LLM_PID, port $FAKE_LLM_PORT)"
+    break
+  fi
+  sleep 0.5
+  [[ $i -eq 30 ]] && { tail /tmp/fake-llm.log; fail "fake LLM did not come up"; }
+done
+
+info "run ework-aio install (writes opencode.json with plugin only)"
+ework-aio install \
+  --allow-root \
+  --data-dir "$DATA_DIR" \
+  --port "$WORK_PORT" \
+  --daemon-port "$DAEMON_PORT" \
+  --bot-name e2e-bot \
+  --yes 2>&1 | tee /tmp/install.log | tail -5
+
+pass "install exited 0"
+
+info "verify services respond"
+for i in $(seq 1 60); do
+  curl -sf "http://127.0.0.1:$WORK_PORT/login" >/dev/null && break
+  sleep 0.5
+  [[ $i -eq 60 ]] && fail "ework-web did not come up"
+done
+for i in $(seq 1 60); do
+  curl -sf "http://127.0.0.1:$DAEMON_PORT/api/status" >/dev/null && break
+  sleep 0.5
+  [[ $i -eq 60 ]] && fail "daemon did not come up"
+done
+pass "both services responding"
+
+info "configure opencode to use fake LLM"
+# Overwrite ~/.config/opencode/opencode.json with fake provider + plugin.
+# install.ts only registers the plugin; we add the fake provider here so
+# the test stays isolated from any real API credentials.
+OPENCODE_CONFIG_DIR="$HOME/.config/opencode"
+mkdir -p "$OPENCODE_CONFIG_DIR"
+cat > "$OPENCODE_CONFIG_DIR/opencode.json" <<OCJSON
+{
+  "\$schema": "https://opencode.ai/config.json",
+  "plugin": ["opencode-ework@latest"],
+  "provider": {
+    "fake": {
+      "npm": "@ai-sdk/openai-compatible",
+      "name": "Fake (E2E test)",
+      "options": {
+        "baseURL": "http://127.0.0.1:$FAKE_LLM_PORT/v1"
+      },
+      "models": {
+        "fake-model": {
+          "name": "Fake Model"
+        }
+      }
+    }
+  },
+  "model": "fake/fake-model"
+}
+OCJSON
+pass "opencode.json points at fake LLM"
+
+info "warm up opencode (first-run DB migration takes minutes)"
+# Opencode prints "Performing one time database migration, may take a few
+# minutes..." on its first invocation against a fresh DB. If we don't warm
+# it up here, both the smoke test AND the daemon's spawned opencode get
+# killed mid-migration and never reach the chat step. Running any cheap
+# command against the DB triggers the migration once; subsequent runs are
+# fast. `session list` is the cheapest touch we can do.
+# </dev/null: opencode session list reads stdin (cosmetic for list mode,
+# but defensive — see smoke test comment for the heredoc-eof trap).
+timeout -s KILL 300 opencode session list </dev/null >/dev/null 2>&1 || true
+pass "opencode warm-up done (migration triggered if needed)"
+
+info "verify opencode can reach fake LLM (manual smoke)"
+# SIGKILL after 90s — opencode can hang on tool-call prompts if the LLM
+# response shape is wrong; SIGTERM is caught for cleanup and takes longer.
+# 90s because even post-migration, first stream response can take 10-20s.
+#
+# </dev/null is critical: this script's heredoc provides bash's stdin.
+# opencode run reads stdin when waiting for prompts, which would silently
+# consume the rest of the heredoc — bash then hits EOF and exits without
+# running any subsequent step.
+cd /tmp && timeout -s KILL 90 opencode run --format json --model fake/fake-model --dir /tmp "manual smoke test" </dev/null > /tmp/smoke.json 2>&1 || true
+pass "opencode smoke test ran (output captured)"
+echo "  events: $(wc -l < /tmp/smoke.json)"
+echo "  --- smoke.json content (first 1000 chars) ---"
+head -c 1000 /tmp/smoke.json
+echo
+echo "  --- fake-llm log tail ---"
+tail -5 /tmp/fake-llm.log
+
+info "create issue that triggers daemon → opencode → fake LLM"
+# Build admin cookie (same recipe as e2e-install.sh).
+WORK_TOKEN=$(grep ^WORK_TOKEN= "$DATA_DIR/ework-web/.env" | cut -d= -f2-)
+WORK_COOKIE_SECRET=$(grep ^WORK_COOKIE_SECRET= "$DATA_DIR/ework-web/.env" | cut -d= -f2-)
+COOKIE_SIG=$(printf '%s' "$WORK_TOKEN" \
+  | openssl dgst -sha256 -hmac "$WORK_COOKIE_SECRET" -binary \
+  | base64 | tr '+/' '-_' | tr -d '=')
+AUTH_COOKIE="ework_auth=${WORK_TOKEN}.${COOKIE_SIG}"
+
+# Create project (idempotent — if it exists, 303 is still returned).
+curl -sS -o /dev/null -w 'project: %{http_code}\n' -X POST \
+  "http://127.0.0.1:$WORK_PORT/projects" \
+  -H "Cookie: $AUTH_COOKIE" \
+  --data-urlencode 'owner=e2e' \
+  --data-urlencode 'name=browser-test'
+
+# Create issue (triggers webhook → daemon → opencode).
+ISSUE_TITLE="Browser E2E $(date +%s)"
+curl -sS -o /dev/null -w 'issue: %{http_code}\n' -X POST \
+  "http://127.0.0.1:$WORK_PORT/e2e/browser-test/issues" \
+  -H "Cookie: $AUTH_COOKIE" \
+  --data-urlencode "title=$ISSUE_TITLE" \
+  --data-urlencode 'body=please reply with anything'
+
+info "wait for daemon to process the issue + spawn opencode"
+# daemon polls every few seconds; opencode run takes a few seconds against
+# fake LLM. Give it generous room.
+for i in $(seq 1 60); do
+  ACTIVE=$(curl -sS "http://127.0.0.1:$DAEMON_PORT/api/status" | jq -r '.issues // 0')
+  if [[ "$ACTIVE" -ge 1 ]]; then
+    pass "daemon registered issue after ${i} seconds (issues=$ACTIVE)"
+    break
+  fi
+  sleep 1
+  [[ $i -eq 60 ]] && fail "daemon did not register issue"
+done
+
+info "wait for opencode to write a session"
+OPENCODE_DB="$HOME/.local/share/opencode/opencode.db"
+# Query opencode.db via bun (bun:sqlite ships with the runtime, no extra
+# dependency to apt install). One-line JS keeps the bash flow readable.
+sql_query() {
+  bun -e "const db=require('bun:sqlite');const d=new db.Database('$1',{readonly:true,create:false});try{process.stdout.write(JSON.stringify(d.prepare(\`$2\`).all()))}catch(e){process.stdout.write('')}" 2>/dev/null
+}
+SESSION_ID=""
+# 180s window: opencode spawn + fake-LLM roundtrip + write to DB. The
+# daemon's poller picks up the issue within ~30s, then opencode takes
+# 5-30s depending on warm-up state.
+for i in $(seq 1 180); do
+  ROWS=$(sql_query "$OPENCODE_DB" "SELECT id FROM session ORDER BY time_updated DESC LIMIT 1;")
+  SESSION_ID=$(echo "$ROWS" | jq -r '.[0].id // empty' 2>/dev/null || echo "")
+  if [[ -n "$SESSION_ID" ]]; then
+    pass "session created: $SESSION_ID (after ${i}s)"
+    break
+  fi
+  sleep 1
+  [[ $i -eq 180 ]] && {
+    echo "--- daemon.log (last 40) ---"
+    tail -40 "$DATA_DIR/run/daemon.log" 2>/dev/null || echo "(no daemon.log)"
+    echo "--- fake-llm log (last 10) ---"
+    tail -10 /tmp/fake-llm.log
+    fail "opencode did not write a session";
+  }
+done
+
+info "wait for session to have assistant content (fake LLM reply)"
+for i in $(seq 1 30); do
+  ROWS=$(sql_query "$OPENCODE_DB" "SELECT COUNT(*) AS n FROM message WHERE session_id='${SESSION_ID}';")
+  MSG_COUNT=$(echo "$ROWS" | jq -r '.[0].n // 0' 2>/dev/null || echo 0)
+  if [[ "$MSG_COUNT" -ge 2 ]]; then
+    pass "session has $MSG_COUNT messages (user + assistant)"
+    break
+  fi
+  sleep 1
+  [[ $i -eq 30 ]] && fail "session never got assistant reply (msgs=$MSG_COUNT)";
+done
+
+info "verify session is browsable via awork-web"
+# awork-web's OpencodeClient reads opencode.db and calls `opencode export`.
+# Hit the /sessions list and the specific session page. Both require the
+# admin auth cookie (otherwise 302 → /login).
+SESSIONS_RESP=$(curl -sS -i -H "Cookie: $AUTH_COOKIE" "http://127.0.0.1:$WORK_PORT/sessions")
+SESSIONS_HTML=$(echo "$SESSIONS_RESP" | tail -n +5)
+SESSIONS_STATUS=$(echo "$SESSIONS_RESP" | head -1)
+if ! echo "$SESSIONS_HTML" | grep -q "$SESSION_ID"; then
+  echo "--- HTTP status: $SESSIONS_STATUS ---"
+  echo "--- /sessions response (first 2000 chars of body) ---"
+  echo "$SESSIONS_HTML" | head -c 2000
+  echo
+  echo "--- sessions actually in opencode.db ---"
+  sql_query "$OPENCODE_DB" "SELECT id, time_created, time_archived FROM session ORDER BY time_created DESC LIMIT 5;" | jq . 2>/dev/null
+  echo "--- ework-web access log (last 20) ---"
+  tail -20 "$DATA_DIR/run/web-access.log" 2>/dev/null || echo "(no access log)"
+  fail "/sessions list does not contain the new session ID"
+fi
+pass "/sessions lists the new session"
+
+SESSION_PAGE_HTML=$(curl -sS -H "Cookie: $AUTH_COOKIE" "http://127.0.0.1:$WORK_PORT/sessions/$SESSION_ID")
+# Look for any marker that the fake LLM reply rendered. The reply body always
+# starts with "E2E fake-LLM reply" so we grep for that substring.
+echo "$SESSION_PAGE_HTML" | grep -q "E2E fake-LLM" \
+  || fail "session page does not contain fake-LLM reply text"
+pass "session page renders fake-LLM reply content"
+
+info "drive headless browser through the UI"
+# bun (not tsx) because the script imports `bun:sqlite` to peek at opencode.db.
+cp /host-test/browser-flow.ts /tmp/test-runner/
+WORK_PORT="$WORK_PORT" \
+WORK_DATA_DIR="$DATA_DIR" \
+OPENCODE_DB="$OPENCODE_DB" \
+HEADLESS=1 \
+bun /tmp/test-runner/browser-flow.ts
+pass "browser flow test PASSED"
+
+info "fake LLM log tail"
+tail -10 /tmp/fake-llm.log
+
+echo
+echo "====================================================="
+echo "BROWSER E2E PASSED"
+echo "====================================================="
+echo "  session ID:       $SESSION_ID"
+echo "  session URL:      http://127.0.0.1:$WORK_PORT/sessions/$SESSION_ID"
+echo "  fake LLM log:     /tmp/fake-llm.log"
+echo "  data dir:         $DATA_DIR"
+
+# Kill fake LLM (container exit also does this, but explicit is clearer).
+kill "$FAKE_LLM_PID" 2>/dev/null || true
+EOSCRIPT
+
+echo
+echo "${c_grn}BROWSER E2E COMPLETE${c_rst}"

package/scripts/e2e-install.sh

@@ -1,19 +1,24 @@
 #!/usr/bin/env bash
-# End-to-end install test.
+# End-to-end install + lifecycle + subcommand test.
 #
-# Spawns a clean debian container (via Dockerfile.regression) and runs the
-# FULL `ework-aio install` flow — not a hand-rolled .env like the older
-# regression.sh. This is the test that would have caught every bug we
-# shipped between v0.2.0 and v0.2.6:
+# Spawns a clean debian container (via Dockerfile.regression) and exercises:
+#   1. Install paths: --allow-root + re-install idempotency
+#   2. Service startup: web /login + daemon /api/status
+#   3. Subcommand smoke: status, env, config list/get/set, logs
+#   4. Service lifecycle: stop / start / restart (PIDs change)
+#   5. Issue flow: create project → create issue → daemon receives webhook
+#   6. Cleanup: uninstall removes pidfiles + kills services
 #
-#   - v0.2.4 plugin key fix    → caught by issue-create → daemon receives webhook
-#   - v0.2.5 daemon binary fix → caught by /api/status probe (was printing help)
-#   - v0.2.6 webhook secret    → caught by "no invalid signature in daemon.log"
-#   - v0.2.6 access log        → caught by "no EACCES in web.log"
+# Each block also documents which past bug the assertion prevents:
+#   v0.2.4 plugin key    → issue-create → daemon receives webhook
+#   v0.2.5 daemon binary → /api/status probe (was printing help + exiting 0)
+#   v0.2.6 secret drift  → "no invalid signature in daemon.log"
+#   v0.2.6 access log    → "no EACCES in web.log"
+#   v0.2.7+ regression   → all subcommands exit 0 with expected markers
 #
 # Usage: ./scripts/e2e-install.sh [container-runtime] [npm-tag]
 #   container-runtime: docker (default) | podman
-#   npm-tag:           latest (default) | 0.2.6 | file:.. (for local builds)
+#   npm-tag:           latest (default) | 0.2.7 | file:.. (for local builds)
 
 set -euo pipefail
 
@@ -38,9 +43,12 @@ fi
 info "Using image: $IMAGE  (testing npm tag: $NPM_TAG)"
 
 # Unique ports so we don't collide with a host-side ework stack when run with
-# --network host. Override via env if needed.
-WORK_PORT="${WORK_PORT:-14002}"
-DAEMON_PORT="${DAEMON_PORT:-14101}"
+# --network host. OVERRIDE via env only if you know what you're doing — by
+# default we IGNORE any inherited WORK_PORT/DAEMON_PORT from the host shell
+# (a host running ework-daemon on :3100 would otherwise leak into the test
+# and break assertions about which port the container's daemon binds to).
+WORK_PORT="14002"
+DAEMON_PORT="14101"
 
 # opencode binary is host-specific (path may differ across machines). Mount
 # readonly so the container preflight sees it on PATH. Override via env.
@@ -69,14 +77,96 @@ DAEMON_PORT="${DAEMON_PORT:-14101}"
 NPM_TAG="${NPM_TAG:-latest}"
 DATA_DIR=/tmp/aio-e2e
 
+# Defend against host env leak: the OUTER script always passes -e WORK_PORT
+# and -e DAEMON_PORT, but if the user invokes this heredoc directly from a
+# shell that has DAEMON_PORT set (e.g. their production daemon on :3100),
+# the assertions below will fail mysteriously. The values above are the
+# authoritative defaults; only override via the outer script's env passthrough.
+
+# -----------------------------------------------------------------------------
+# Helpers
+# -----------------------------------------------------------------------------
+
+# Poll a URL until it returns < 500, or fail after N half-seconds.
+wait_for_url() {
+  local url="$1" name="$2" half_seconds="${3:-60}"
+  for i in $(seq 1 "$half_seconds"); do
+    if curl -sf -o /dev/null "$url"; then
+      pass "$name responds (after ${i} half-seconds)"
+      return 0
+    fi
+    sleep 0.5
+  done
+  return 1
+}
+
+# Read .env key value (last match wins — install.ts overwrites keys in place).
+env_val() { grep "^$1=" "$2" | tail -1 | cut -d= -f2-; }
+
+# Build admin auth cookie from web .env.
+build_auth_cookie() {
+  local web_env="$DATA_DIR/ework-web/.env"
+  local token secret sig
+  token=$(env_val WORK_TOKEN "$web_env")
+  secret=$(env_val WORK_COOKIE_SECRET "$web_env")
+  sig=$(printf '%s' "$token" \
+    | openssl dgst -sha256 -hmac "$secret" -binary \
+    | base64 | tr '+/' '-_' | tr -d '=')
+  echo "ework_auth=${token}.${sig}"
+}
+
+# Read PID from pidfile (or echo empty if missing/empty).
+pid_of() {
+  local pf="$DATA_DIR/run/$1.pid"
+  [[ -f "$pf" ]] || { echo ""; return; }
+  echo "$(cat "$pf")"
+}
+
+# Is a PID alive?
+pid_alive() { kill -0 "$1" >/dev/null 2>&1; }
+
+# Wait for a service's pidfile PID to differ from the given "old" PID.
+wait_for_new_pid() {
+  local svc="$1" old_pid="$2" half_seconds="${3:-40}"
+  for i in $(seq 1 "$half_seconds"); do
+    local new_pid
+    new_pid=$(pid_of "$svc")
+    if [[ -n "$new_pid" && "$new_pid" != "$old_pid" ]] && pid_alive "$new_pid"; then
+      pass "$svc pid changed ($old_pid → $new_pid) after ${i} half-seconds"
+      return 0
+    fi
+    sleep 0.5
+  done
+  return 1
+}
+
+# Wait for a service's pidfile to vanish (or PID to die).
+wait_for_no_pid() {
+  local svc="$1" half_seconds="${2:-30}"
+  for i in $(seq 1 "$half_seconds"); do
+    local pid
+    pid=$(pid_of "$svc")
+    if [[ -z "$pid" ]] || ! pid_alive "$pid"; then
+      pass "$svc stopped (no live pid) after ${i} half-seconds"
+      return 0
+    fi
+    sleep 0.5
+  done
+  return 1
+}
+
+echo "====================================================="
+echo "Phase 0: clean state + npm install"
+echo "====================================================="
 info "clean state"
 rm -rf "$DATA_DIR"
 mkdir -p "$DATA_DIR"
 
 info "opencode binary on PATH"
 opencode --version | head -1
+pass "opencode present"
 
-info "npm install -g ework-web@${NPM_TAG} ework-daemon@latest ework-aio@${NPM_TAG}"
+info "npm install -g ework-web@latest ework-daemon@latest opencode-ework@latest ework-aio@${NPM_TAG}"
 # Note: ework-web and ework-daemon aren't version-locked to ework-aio. We
 # always install latest of the services and only parameterize ework-aio so
 # we can E2E-test a PR branch against published services.
@@ -85,13 +175,21 @@ for pkg in ework-web ework-daemon opencode-ework; do
 done
 npm install -g "ework-aio@${NPM_TAG}" 2>&1 | tail -2
 
+# -----------------------------------------------------------------------------
+# Phase 1: install paths
+# -----------------------------------------------------------------------------
+echo
+echo "====================================================="
+echo "Phase 1: install paths"
+echo "====================================================="
+
 info "v0.2.5 regression: all 4 bins on PATH"
 for b in ework-aio ework-web ework-daemon ework-daemon-server; do
   command -v "$b" >/dev/null 2>&1 || fail "$b not on PATH"
   pass "$b -> $(command -v "$b")"
 done
 
-info "run ework-aio install (the real installer — no hand-rolled .env)"
+info "install path A: --allow-root + custom ports + --yes"
 # --allow-root: container runs as root; refusing would test an unrealistic
 # path. The installer's data still lands in /tmp/aio-e2e via --data-dir.
 ework-aio install \
@@ -102,11 +200,33 @@ ework-aio install \
   --bot-name e2e-bot \
   --yes 2>&1 | tee /tmp/install.log
 
-pass "install exited 0"
+pass "install (path A) exited 0"
+
+info "install path B: re-install over existing data dir (idempotency)"
+# Re-running install should not crash on existing .env / pidfiles / webhooks.
+# This catches bugs where install.ts isn't idempotent (e.g. UNIQUE constraint
+# on second bot token, or "file exists" on second .env write).
+ework-aio install \
+  --allow-root \
+  --data-dir "$DATA_DIR" \
+  --port "$WORK_PORT" \
+  --daemon-port "$DAEMON_PORT" \
+  --bot-name e2e-bot \
+  --yes 2>&1 | tee /tmp/install2.log | tail -10
+
+pass "install (path B: idempotent re-install) exited 0"
+
+# -----------------------------------------------------------------------------
+# Phase 2: post-install assertions (regression suite for v0.2.5 / v0.2.6)
+# -----------------------------------------------------------------------------
+echo
+echo "====================================================="
+echo "Phase 2: post-install env / regression assertions"
+echo "====================================================="
 
 info "v0.2.6 regression: webhook secrets match across web and daemon .env"
-WEB_SEC=$(grep ^WORK_DAEMON_WEBHOOK_SECRET= "$DATA_DIR/ework-web/.env" | cut -d= -f2-)
-DAE_SEC=$(grep ^GITEA_WEBHOOK_SECRET= "$DATA_DIR/ework-daemon/.env" | cut -d= -f2-)
+WEB_SEC=$(env_val WORK_DAEMON_WEBHOOK_SECRET "$DATA_DIR/ework-web/.env")
+DAE_SEC=$(env_val GITEA_WEBHOOK_SECRET "$DATA_DIR/ework-daemon/.env")
 [[ -n "$WEB_SEC" ]] || fail "WORK_DAEMON_WEBHOOK_SECRET empty in web .env"
 [[ -n "$DAE_SEC" ]] || fail "GITEA_WEBHOOK_SECRET empty in daemon .env"
 [[ "$WEB_SEC" == "$DAE_SEC" ]] \
@@ -114,31 +234,19 @@ DAE_SEC=$(grep ^GITEA_WEBHOOK_SECRET= "$DATA_DIR/ework-daemon/.env" | cut -d= -f
 pass "secrets match (${#WEB_SEC} chars)"
 
 info "v0.2.6 regression: WORK_ACCESS_LOG set, not defaulting to /tmp/ework-access.log"
-ACCESS_LOG_VAL=$(grep ^WORK_ACCESS_LOG= "$DATA_DIR/ework-web/.env" | cut -d= -f2-)
+ACCESS_LOG_VAL=$(env_val WORK_ACCESS_LOG "$DATA_DIR/ework-web/.env")
 [[ -n "$ACCESS_LOG_VAL" ]] || fail "WORK_ACCESS_LOG missing from web .env"
 [[ "$ACCESS_LOG_VAL" != "/tmp/ework-access.log" ]] \
   || fail "WORK_ACCESS_LOG still defaults to /tmp/ework-access.log"
 pass "WORK_ACCESS_LOG=$ACCESS_LOG_VAL"
 
 info "wait for ework-web /login"
-for i in $(seq 1 60); do
-  if curl -sf -o /dev/null "http://127.0.0.1:$WORK_PORT/login"; then
-    pass "/login responds (after ${i} half-seconds)"
-    break
-  fi
-  sleep 0.5
-  [[ $i -eq 60 ]] && { tail -30 "$DATA_DIR/run/web.log" 2>/dev/null; fail "ework-web did not come up"; }
-done
+wait_for_url "http://127.0.0.1:$WORK_PORT/login" "/login" 60 \
+  || { tail -30 "$DATA_DIR/run/web.log" 2>/dev/null; fail "ework-web did not come up"; }
 
 info "wait for daemon /api/status"
-for i in $(seq 1 60); do
-  if curl -sf -o /dev/null "http://127.0.0.1:$DAEMON_PORT/api/status"; then
-    pass "/api/status responds (after ${i} half-seconds)"
-    break
-  fi
-  sleep 0.5
-  [[ $i -eq 60 ]] && { tail -30 "$DATA_DIR/run/daemon.log" 2>/dev/null; fail "daemon did not come up"; }
-done
+wait_for_url "http://127.0.0.1:$DAEMON_PORT/api/status" "/api/status" 60 \
+  || { tail -30 "$DATA_DIR/run/daemon.log" 2>/dev/null; fail "daemon did not come up"; }
 
 info "v0.2.6 regression: no EACCES in web.log"
 sleep 1
@@ -155,13 +263,170 @@ if grep -q "invalid signature" "$DATA_DIR/run/daemon.log" 2>/dev/null; then
 fi
 pass "no invalid signature yet"
 
+# -----------------------------------------------------------------------------
+# Phase 3: subcommand smoke tests
+# -----------------------------------------------------------------------------
+echo
+echo "====================================================="
+echo "Phase 3: subcommand smoke tests"
+echo "====================================================="
+
+info "status: lists both services, both running, both listening"
+STATUS_OUT=$(ework-aio status --data-dir "$DATA_DIR" 2>&1)
+echo "$STATUS_OUT"
+echo "$STATUS_OUT" | grep -q "ework-web"    || fail "status missing ework-web line"
+echo "$STATUS_OUT" | grep -q "ework-daemon" || fail "status missing ework-daemon line"
+echo "$STATUS_OUT" | grep "ework-web"    | grep -q "✓ running"    || fail "web not reported running"
+echo "$STATUS_OUT" | grep "ework-daemon" | grep -q "✓ running"    || {
+  echo "$STATUS_OUT" | grep "ework-daemon"
+  fail "daemon not reported running (see status output above)"
+}
+pass "status lists both services as running"
+
+info "env: prints key paths"
+ENV_OUT=$(ework-aio env --data-dir "$DATA_DIR" 2>&1)
+echo "$ENV_OUT"
+echo "$ENV_OUT" | grep -q "data dir"   || fail "env missing 'data dir'"
+echo "$ENV_OUT" | grep -q "web env"    || fail "env missing 'web env'"
+echo "$ENV_OUT" | grep -q "daemon env" || fail "env missing 'daemon env'"
+echo "$ENV_OUT" | grep -q "bot token"  || fail "env missing 'bot token'"
+# env.ts globs for bot-token* (install.ts writes bot-token.<botName> when
+# --bot-name isn't default). With --bot-name e2e-bot in this run, the env
+# output MUST list the suffixed file.
+echo "$ENV_OUT" | grep -q "bot-token.e2e-bot" \
+  || fail "env missing bot-token.e2e-bot (install wrote it but env didn't list it)"
+# Sanity: the printed .env paths must actually exist.
+for p in "$DATA_DIR/ework-web/.env" "$DATA_DIR/ework-daemon/.env"; do
+  [[ -f "$p" ]] || fail "env printed non-existent path: $p"
+done
+pass "env prints valid paths (including bot-token suffix)"
+
+info "config list: shows settable keys"
+CONFIG_LIST_OUT=$(ework-aio config list --data-dir "$DATA_DIR" 2>&1)
+echo "$CONFIG_LIST_OUT"
+echo "$CONFIG_LIST_OUT" | grep -q "WORK_PORT"    || fail "config list missing WORK_PORT"
+echo "$CONFIG_LIST_OUT" | grep -q "DAEMON_PORT"  || fail "config list missing DAEMON_PORT"
+# Secrets must NOT appear (enforced by SECRET_ENV_VARS exclusion).
+echo "$CONFIG_LIST_OUT" | grep -q "WORK_TOKEN" \
+  && fail "config list leaks WORK_TOKEN (should be excluded)" || true
+pass "config list shows settable keys, excludes secrets"
+
+info "config get WORK_PORT: prints the port"
+CONFIG_GET_OUT=$(ework-aio config get WORK_PORT --data-dir "$DATA_DIR" 2>&1)
+echo "$CONFIG_GET_OUT"
+[[ "$CONFIG_GET_OUT" == "$WORK_PORT" ]] \
+  || fail "config get WORK_PORT returned '$CONFIG_GET_OUT', expected '$WORK_PORT'"
+pass "config get WORK_PORT = $WORK_PORT"
+
+info "config get on a secret key: rejects"
+if ework-aio config get WORK_TOKEN --data-dir "$DATA_DIR" 2>/dev/null; then
+  fail "config get WORK_TOKEN should have been rejected"
+fi
+pass "config get on secret rejected"
+
+info "config set WORK_TTS_SPEED 1.5 --no-restart: writes .env, no restart"
+ework-aio config set WORK_TTS_SPEED 1.5 --no-restart --data-dir "$DATA_DIR" 2>&1 | tail -5
+TTS_VAL=$(env_val WORK_TTS_SPEED "$DATA_DIR/ework-web/.env")
+[[ "$TTS_VAL" == "1.5" ]] || fail "WORK_TTS_SPEED not persisted in .env (got '$TTS_VAL')"
+pass "config set persisted WORK_TTS_SPEED=1.5"
+
+info "config set with newline value: rejected (env-injection guard)"
+# Pre-v0.2.6, a value like "alice\nWORK_TOKEN=evil" would inject a new key
+# into .env. cli-dispatch.test.ts:138 covers this in unit tests; we cover
+# it here too because the integration surface (bash quoting) differs.
+if ework-aio config set WORK_OPERATOR_LOGIN $'alice\nWORK_TOKEN=evil' \
+     --no-restart --data-dir "$DATA_DIR" 2>/dev/null; then
+  fail "config set accepted a newline value (env-injection regression)"
+fi
+pass "config set rejects newline value"
+# Confirm the injection didn't actually happen.
+if grep -q "^WORK_TOKEN=evil" "$DATA_DIR/ework-web/.env"; then
+  fail "WORK_TOKEN=evil was injected into .env despite rejection"
+fi
+pass "no env injection occurred"
+
+info "logs web: starts tailing, exits on SIGTERM"
+# logs.ts uses fs.watchFile and never resolves — must be killed.
+# Use `timeout` to send SIGTERM after 1s; expect exit 124 (timeout's SIGTERM
+# exit) or 143 (SIGTERM). The point: it started without error (no
+# "log file not found") and produced output.
+set +e
+LOGS_OUT=$(timeout -s TERM 1 ework-aio logs web --data-dir "$DATA_DIR" 2>&1)
+LOGS_RC=$?
+set -e
+[[ $LOGS_RC -eq 124 || $LOGS_RC -eq 143 ]] \
+  || fail "logs web exited $LOGS_RC (expected 124/143 from SIGTERM)"
+# Output should contain SOMETHING (the "tailing" line + recent log content).
+[[ -n "$LOGS_OUT" ]] || fail "logs web produced no output"
+pass "logs web tail started, exited cleanly on SIGTERM"
+
+# -----------------------------------------------------------------------------
+# Phase 4: service lifecycle (stop / start / restart)
+# -----------------------------------------------------------------------------
+echo
+echo "====================================================="
+echo "Phase 4: service lifecycle"
+echo "====================================================="
+
+WEB_PID_BEFORE=$(pid_of web)
+DAEMON_PID_BEFORE=$(pid_of daemon)
+[[ -n "$WEB_PID_BEFORE" ]]    || fail "web pid empty before stop"
+[[ -n "$DAEMON_PID_BEFORE" ]] || fail "daemon pid empty before stop"
+pass "before stop: web pid=$WEB_PID_BEFORE, daemon pid=$DAEMON_PID_BEFORE"
+
+info "stop both services"
+ework-aio stop --data-dir "$DATA_DIR" 2>&1 | tail -5
+wait_for_no_pid web    || fail "web pid still alive after stop"
+wait_for_no_pid daemon || fail "daemon pid still alive after stop"
+
+info "confirm /login stops responding"
+sleep 1
+if curl -sf -o /dev/null "http://127.0.0.1:$WORK_PORT/login" 2>/dev/null; then
+  fail "/login still responds after stop — web did not actually stop"
+fi
+pass "/login stopped responding"
+
+info "start both services"
+ework-aio start --data-dir "$DATA_DIR" 2>&1 | tail -5
+# Wait for both services to bind their ports again.
+wait_for_url "http://127.0.0.1:$WORK_PORT/login" "/login after start" 60 \
+  || { tail -30 "$DATA_DIR/run/web.log"; fail "web did not come up after start"; }
+wait_for_url "http://127.0.0.1:$DAEMON_PORT/api/status" "/api/status after start" 60 \
+  || { tail -30 "$DATA_DIR/run/daemon.log"; fail "daemon did not come up after start"; }
+
+WEB_PID_AFTER_START=$(pid_of web)
+DAEMON_PID_AFTER_START=$(pid_of daemon)
+[[ "$WEB_PID_AFTER_START" != "$WEB_PID_BEFORE" ]] \
+  || fail "web pid unchanged across stop+start ($WEB_PID_BEFORE)"
+[[ "$DAEMON_PID_AFTER_START" != "$DAEMON_PID_BEFORE" ]] \
+  || fail "daemon pid unchanged across stop+start ($DAEMON_PID_BEFORE)"
+pass "PIDs changed after stop+start (web $WEB_PID_BEFORE→$WEB_PID_AFTER_START)"
+
+info "restart both services (config restart both)"
+ework-aio config restart both --data-dir "$DATA_DIR" 2>&1 | tail -5
+wait_for_new_pid web "$WEB_PID_AFTER_START" 60 \
+  || fail "web pid did not change after restart"
+wait_for_new_pid daemon "$DAEMON_PID_AFTER_START" 60 \
+  || fail "daemon pid did not change after restart"
+
+info "confirm services respond after restart"
+wait_for_url "http://127.0.0.1:$WORK_PORT/login" "/login after restart" 60 \
+  || fail "web did not come up after restart"
+wait_for_url "http://127.0.0.1:$DAEMON_PORT/api/status" "/api/status after restart" 60 \
+  || fail "daemon did not come up after restart"
+
+# -----------------------------------------------------------------------------
+# Phase 5: issue flow (the actual product path)
+# -----------------------------------------------------------------------------
+echo
+echo "====================================================="
+echo "Phase 5: issue flow (create project → create issue → webhook)"
+echo "====================================================="
+
 info "build admin auth cookie"
-WORK_TOKEN=$(grep ^WORK_TOKEN= "$DATA_DIR/ework-web/.env" | cut -d= -f2-)
-WORK_COOKIE_SECRET=$(grep ^WORK_COOKIE_SECRET= "$DATA_DIR/ework-web/.env" | cut -d= -f2-)
-COOKIE_SIG=$(printf '%s' "$WORK_TOKEN" \
-  | openssl dgst -sha256 -hmac "$WORK_COOKIE_SECRET" -binary \
-  | base64 | tr '+/' '-_' | tr -d '=')
-AUTH_COOKIE="ework_auth=${WORK_TOKEN}.${COOKIE_SIG}"
+AUTH_COOKIE=$(build_auth_cookie)
+[[ -n "$AUTH_COOKIE" ]] || fail "auth cookie empty"
+pass "auth cookie built"
 
 info "create test project (triggers autoWire webhook registration)"
 PROJ_CODE=$(curl -sS -o /dev/null -w '%{http_code}' -X POST \
@@ -200,8 +465,41 @@ ACTIVE=$(curl -sS "http://127.0.0.1:$DAEMON_PORT/api/status" | jq -r '.issues //
   || fail "daemon did not register the issue (issues=$ACTIVE)"
 pass "daemon registered issue (issues=$ACTIVE)"
 
+# -----------------------------------------------------------------------------
+# Phase 6: uninstall
+# -----------------------------------------------------------------------------
+echo
+echo "====================================================="
+echo "Phase 6: uninstall"
+echo "====================================================="
+
+info "ework-aio uninstall: stops services + removes pidfiles"
+ework-aio uninstall --data-dir "$DATA_DIR" 2>&1 | tail -10
+
+wait_for_no_pid web 15 || fail "web pid still alive after uninstall"
+wait_for_no_pid daemon 15 || fail "daemon pid still alive after uninstall"
+
+# pidfiles should be gone OR empty.
+for svc in web daemon; do
+  pf="$DATA_DIR/run/$svc.pid"
+  if [[ -f "$pf" && -s "$pf" ]]; then
+    fail "$svc.pid still exists and non-empty after uninstall: $(cat "$pf")"
+  fi
+done
+pass "pidfiles cleared"
+
+info "uninstall preserves data dir"
+# uninstall.ts:62 documents "services removed. data preserved at <dir>".
+# Verify the .env files survive so a re-install picks up the same token.
+[[ -f "$DATA_DIR/ework-web/.env" ]]    || fail "web .env deleted by uninstall"
+[[ -f "$DATA_DIR/ework-daemon/.env" ]] || fail "daemon .env deleted by uninstall"
+pass "data preserved (both .env files intact)"
+
+# -----------------------------------------------------------------------------
 echo
-echo "===== E2E PASSED ====="
+echo "====================================================="
+echo "E2E PASSED"
+echo "====================================================="
 echo "  ework-aio version: $(ework-aio --version 2>/dev/null || echo unknown)"
 echo "  data dir:          $DATA_DIR"
 echo "  web:               http://127.0.0.1:$WORK_PORT/login"

package/scripts/fake-llm-server.ts

@@ -0,0 +1,221 @@
+#!/usr/bin/env bun
+// Fake OpenAI-compatible LLM server for E2E tests.
+//
+// Listens on 127.0.0.1:PORT and responds to /v1/chat/completions with a
+// deterministic, context-aware canned reply. Used by the docker E2E test
+// to drive real `opencode run` against a stub LLM — opencode can't tell
+// the difference, writes a real session to opencode.db, and awork-web can
+// then render that session via its normal /sessions/:id route.
+//
+// Why not just stub the opencode binary? Because awork-web reads opencode.db
+// directly (src/opencode.ts:98-139 listSessions) and calls `opencode export`
+// for transcripts — stubbing the binary means re-implementing the SQLite
+// schema, which would silently drift from real opencode. Talking to a fake
+// LLM exercises every piece except the network call to a real model.
+//
+// Usage:
+//   PORT=8400 bun run scripts/fake-llm-server.ts
+//   # or just: bun run scripts/fake-llm-server.ts  (defaults to 8400)
+
+const PORT = parseInt(process.env.PORT ?? "8400", 10);
+const HOST = process.env.HOST ?? "127.0.0.1";
+
+const server = Bun.serve({
+  port: PORT,
+  hostname: HOST,
+  fetch(req) {
+    const url = new URL(req.url);
+    log(`${req.method} ${url.pathname}`);
+
+    if (req.method === "GET" && url.pathname === "/v1/models") {
+      return json({
+        object: "list",
+        data: [
+          {
+            id: "fake-model",
+            object: "model",
+            created: 1_700_000_000_000,
+            owned_by: "e2e-test",
+          },
+        ],
+      });
+    }
+
+    if (req.method === "POST" && url.pathname === "/v1/chat/completions") {
+      return handleChatCompletion(req);
+    }
+
+    return json({ error: `not found: ${req.method} ${url.pathname}` }, 404);
+  },
+});
+
+function log(msg: string): void {
+  process.stderr.write(`[fake-llm] ${new Date().toISOString()} ${msg}\n`);
+}
+
+function json(body: unknown, status = 200): Response {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: {
+      "content-type": "application/json",
+      "access-control-allow-origin": "*",
+    },
+  });
+}
+
+async function handleChatCompletion(req: Request): Promise<Response> {
+  let body: any;
+  try {
+    body = await req.json();
+  } catch (err) {
+    return json({ error: `invalid JSON: ${(err as Error).message}` }, 400);
+  }
+
+  // Log the full request so we can see what opencode/@ai-sdk is asking for
+  // (stream vs non-stream, tool definitions, system prompt, etc).
+  log(`  body: stream=${body?.stream} model=${body?.model} msgs=${body?.messages?.length} tools=${body?.tools?.length ?? 0}`);
+
+  const messages = Array.isArray(body?.messages) ? body.messages : [];
+  const userMsgs = messages.filter((m: any) => m?.role === "user");
+  const lastUser = userMsgs[userMsgs.length - 1];
+  const userText = typeof lastUser?.content === "string"
+    ? lastUser.content
+    : Array.isArray(lastUser?.content)
+      ? lastUser.content.map((p: any) => p?.text ?? "").join(" ")
+      : "";
+
+  // Deterministic, context-aware reply: echo a snippet of the user's last
+  // message so the session transcript has traceable content (not just a
+  // fixed string). Truncated so the reply stays readable in the UI.
+  const snippet = userText.slice(0, 120).replace(/\s+/g, " ").trim();
+  const reply =
+    `E2E fake-LLM reply.\n\n` +
+    `You said: "${snippet}${userText.length > 120 ? "…" : ""}"\n\n` +
+    `This is a stub response from scripts/fake-llm-server.ts. ` +
+    `The real value of this test is that opencode wrote a real session row ` +
+    `to opencode.db and awork-web can render it end-to-end.`;
+
+  const promptTokens = roughTokens(JSON.stringify(messages));
+  const completionTokens = roughTokens(reply);
+  const usage = {
+    prompt_tokens: promptTokens,
+    completion_tokens: completionTokens,
+    total_tokens: promptTokens + completionTokens,
+  };
+
+  // opencode (@ai-sdk/openai-compatible) defaults to stream=true. Returning
+  // a non-streaming JSON response silently produces a 0-token session row
+  // with no assistant text — the request completes but the transcript is
+  // empty. Honor the stream flag and emit SSE chunks.
+  if (body?.stream === true) {
+    return streamResponse(body?.model ?? "fake-model", reply, usage);
+  }
+
+  // Non-streaming path (used by curl sanity checks in tests).
+  return json({
+    id: `chatcmpl-fake-${crypto.randomUUID()}`,
+    object: "chat.completion",
+    created: Math.floor(Date.now() / 1000),
+    model: body?.model ?? "fake-model",
+    choices: [
+      {
+        index: 0,
+        message: { role: "assistant", content: reply },
+        finish_reason: "stop",
+      },
+    ],
+    usage,
+  });
+}
+
+function streamResponse(model: string, reply: string, usage: any): Response {
+  const id = `chatcmpl-fake-${crypto.randomUUID()}`;
+  const created = Math.floor(Date.now() / 1000);
+
+  // Split into ~10 chunks so the streaming code path actually streams
+  // (single-chunk streams work but look unrealistic in logs).
+  const chunks: string[] = [];
+  const words = reply.split(/(\s+)/);
+  const perChunk = Math.max(1, Math.ceil(words.length / 10));
+  for (let i = 0; i < words.length; i += perChunk) {
+    chunks.push(words.slice(i, i + perChunk).join(""));
+  }
+
+  const encoder = new TextEncoder();
+  const readable = new ReadableStream({
+    start(controller) {
+      // First chunk: role + opening content.
+      controller.enqueue(
+        encoder.encode(
+          sseLine({
+            id,
+            object: "chat.completion.chunk",
+            created,
+            model,
+            choices: [{ index: 0, delta: { role: "assistant", content: chunks[0] ?? "" }, finish_reason: null }],
+          }),
+        ),
+      );
+      // Subsequent chunks: content deltas only.
+      for (let i = 1; i < chunks.length; i++) {
+        controller.enqueue(
+          encoder.encode(
+            sseLine({
+              id,
+              object: "chat.completion.chunk",
+              created,
+              model,
+              choices: [{ index: 0, delta: { content: chunks[i] }, finish_reason: null }],
+            }),
+          ),
+        );
+      }
+      // Final chunk: empty delta + finish_reason + usage (usage must be on
+      // the final chunk when stream_options.include_usage is set; opencode
+      // sets it so the session row gets non-zero token counts).
+      controller.enqueue(
+        encoder.encode(
+          sseLine({
+            id,
+            object: "chat.completion.chunk",
+            created,
+            model,
+            choices: [{ index: 0, delta: {}, finish_reason: "stop" }],
+            usage,
+          }),
+        ),
+      );
+      controller.enqueue(encoder.encode("data: [DONE]\n\n"));
+      controller.close();
+    },
+  });
+
+  return new Response(readable, {
+    headers: {
+      "content-type": "text/event-stream",
+      "cache-control": "no-cache",
+      "connection": "keep-alive",
+      "access-control-allow-origin": "*",
+    },
+  });
+}
+
+function sseLine(obj: any): string {
+  return `data: ${JSON.stringify(obj)}\n\n`;
+}
+
+function roughTokens(text: string): number {
+  // Crude 4-chars-per-token heuristic. Token counts only need to be >0 for
+  // awork-web's heat bar (which divides by max-peak-token across the session).
+  // Real tokenizer isn't needed for test data.
+  return Math.max(1, Math.ceil(text.length / 4));
+}
+
+process.stderr.write(
+  `[fake-llm] listening on http://${HOST}:${PORT}\n` +
+    `[fake-llm] POST /v1/chat/completions  -> canned OpenAI response\n` +
+    `[fake-llm] GET  /v1/models           -> { fake-model }\n`,
+);
+
+// Keep stderr unbuffered so logs show up immediately in docker output.
+process.stderr.write(`[fake-llm] ready (pid ${process.pid})\n`);

package/src/commands/env.ts

@@ -1,6 +1,8 @@
 // `ework-aio env` — print resolved paths (no secrets). Useful for users
 // to find where data, .env files, and the bot token live without grepping.
 
+import fs from "node:fs";
+import path from "node:path";
 import { Logger } from "../log.ts";
 import { resolvePaths } from "../paths.ts";
 import type { GlobalOptions } from "../types.ts";
@@ -12,13 +14,33 @@ export async function runEnv(opts: GlobalOptions, logger: Logger): Promise<void>
     useSystemd: opts.useSystemd,
   });
 
+  // install.ts writes the bot PAT to <dataDir>/bot-token OR
+  // <dataDir>/bot-token.<botName> when --bot-name isn't the default.
+  // paths.botTokenFile only knows the un-suffixed path, so glob for any
+  // bot-token* matches in the data dir rather than confidently printing a
+  // path that may not exist.
+  let botTokenPaths: string[] = [];
+  try {
+    for (const name of await fs.promises.readdir(paths.dataDir)) {
+      if (name === "bot-token" || name.startsWith("bot-token.")) {
+        botTokenPaths.push(path.join(paths.dataDir, name));
+      }
+    }
+  } catch {
+    // data dir doesn't exist yet — fall through to the un-suffixed default
+    // so the user sees what path install.ts WOULD use.
+  }
+  const botTokenLine = botTokenPaths.length === 0
+    ? `${paths.botTokenFile} (not yet created — run ework-aio install)`
+    : botTokenPaths.join(", ");
+
   logger.hr();
   logger.log("ework-aio paths");
   logger.hr();
   logger.log(`  data dir      : ${paths.dataDir}`);
   logger.log(`  web env       : ${paths.webEnvFile}`);
   logger.log(`  daemon env    : ${paths.daemonEnvFile}`);
-  logger.log(`  bot token     : ${paths.botTokenFile}`);
+  logger.log(`  bot token     : ${botTokenLine}`);
   logger.log(`  opencode cfg  : ${paths.opencodeConfigFile}`);
   logger.log(`  scope         : ${opts.scope}`);
   logger.log(`  mode          : ${opts.useSystemd ? "systemd" : "PID-file"}`);